If you can't use webhooks, then there is an alternative "webhookless flow" documented here https://docs.pact.io/pact_nirvana/step_6#alternative-webhookless-workflow

There is a

verification-required

command in the CLI that is designed for this. I need to remove the feature toggle on it, but you can use it now https://github.com/pact-foundation/pact_broker-client/blob/master/lib/pact_broker/client/cli/matrix_commands.rb#L42

Also in your article on this new webhook event, you write:

The triggered provider build must then check out the specified version of the provider codebase, [...]

but I was thinking it might make sense to use a docker image for each provider service, but based on this, it sounds like that may not be supported?

if you're building on the fly, you can checkout the code then build it. if you're pulling from a docker repository, make sure your pre-built image is tagged with the git sha.